Avast Antivirus Vulnerability in Native Message Dispatcher on Windows
CVE-2026-12067
Key Information:
What is CVE-2026-12067?
A vulnerability exists in the native message dispatcher of Avast Antivirus, where missing exception handlers in the processing of JSON messages can allow a local, unprivileged attacker to crash the service. The problem arises from several handler pathways that convert JSON fields to strings and integers without proper type validation, exposing the system to unhandled exceptions. Specifically, in the Log_NmSvc.message handler and OpenInSz_NmSvc handlers, the absence of try-catch blocks around crucial type conversions leads to potential service disruption. This vulnerability highlights the importance of robust exception handling in service applications to prevent unauthorized crashes.
Affected Version(s)
Avast Antivirus, Avast One, Avast Premium Security, Avast Ultimate, Avast Business Security Windows 0
AVG Antivirus Free, AVG Internet Security, AVG Ultimate Windows 0
Norton Antivirus Plus, Norton 360 Standard, Norton 360 Deluxe, Norton 360 Advanced Windows 0